ELV Systems

What are Extra-Low Voltage Systems (ELV)? 

Extra-Low Voltage means the voltage of electricity supply is in a range that is low enough that it does not carry any high risk of any high voltage electrical shock(s).

The range of voltage that can be classified as Extra-Low Voltage is alternating current not exceeding 50 V AC and direct current not exceeding 120 V DC (ripple free). This is based on the standards as per EN 61558 or BS 7671.

The term extra-low voltage ("ELV") means an operating voltage not exceeding 50 Volt alternating current (a.c.) or 120 Volt ripple free direct current (d.c.) as defined in Australian / New Zealand Standard AS/NZS 3000.

Therefore, Extra-Low Voltage Systems are any electrical systems that can operate on a low voltage with the voltage criteria as per above.

Key Characteristics

·        Low Voltage:The most defining feature is their safe, low-voltage operation, which reduces the risk of electric shock. 

·        Non-Core Systems:ELV systems are separate from the building's main, high-voltage electrical power system. 

·        Integrated Technologies:They are the "smart" components of a building, connecting devices and managing data. 

In this article, we are going to share more about different components of ELV systems.

Components of ELV Systems

Video Surveillance System:

Video-surveillance systems, also more commonly known as Closed Circuit Television, in short "CCTV", is made up of a network of cameras and recording systems that are connected to each other. This system would be classified as a ‘closed’ system as the system operates independently, unless it’s part of an ELV integrated system. A CCTV system is an effective way to monitor and secure any sensitive area(s).

Currently, cameras can be connected either wired or wireless to a CCTV system. CCTVs are an effective deterrence to any threats or area(s) that require constant offsite monitoring.

The key points in installing CCTV cameras is the positioning of the camera, to ensure that the camera can monitor the required area in its scope of view as well as the clarity of the video footage to ensure usability of the footage if necessary.

Access Control System – ACS:

Access control systems are a key feature of any security system hub that can secure, monitor and manage the access of staff in any type of building. With this system, staff can either be given access cards or using fingerprints(biometric), they are able to be granted access to various areas of the premises.

Nowadays, these systems ‘speak’ to each other wirelessly and usually connected to the local area network to reduce hard wiring cost and flexibility of the positioning of the system itself. At times, the access control system might be a part of a bigger integrated ELV system which allows central control of multiple different systems.

Public Address Voice Alarm System – PAVA:

A public address system is a system that allows an amplification of your voice through microphones and loudspeakers. Its purpose is to enhance the volume of human voice or any other sound for that matter.

The general alarm system allows remote control of alarms and flashing lights(beacons).

Combined, this system would serve a general use of relaying information or be used in the case of any emergency evacuations.

Fire Detection & Alarm System - FDAS:

Fire Alarm Control Panel is the brain of the system. Receives input from detectors, Manual call points & sends output to sounders/bells.

ELV fire alarm systems can provide early warning of fires in public and state facilities, allowing for prompt evacuation and reducing the risk of injury or death. These systems can also be integrated into building management systems to provide automatic fire suppression, such as sprinklers or fire extinguishers.

LAN and IP-BX System:

LAN stands for local-area network and is basically an interconnected computer network that usually covers a small area. This network of computer/devices can be connected to each other via physical wires called LAN cables or wirelessly (radio waves).

A telephone system is a group of interconnected telephones connected either via telephone lines or via LAN cables which then communicate using ‘Voice over Internet Protocol’ or in short VoIP.

Intrusion Alarm System - IAS

An intrusion alarm system — also known as a burglar alarm system — is an important security measure that can protect your business from unwanted intruders, theft, vandalism, and property damage.

Intrusion alarm systems provide several key benefits for businesses, such as increased safety for building occupants, faster response times to breaches, and lower insurance premiums. By investing in an intrusion alarm system, you are taking a proactive approach toward the safety and security of your property.

Nurse call system - NCS

A nurse call system is a healthcare technology solution in hospitals and nursing homes that allows patients to request assistance from staff by pressing a call button or using a pendant. These systems feature call buttons, receiving units at the nurse's station, and often wireless devices like pagers or watches to notify nurses in real-time. The primary goal is to ensure timely patient care, improve safety by reducing response times, and enhance staff efficiency through features like real-time alerts and reporting.

Trunk Radio System – TRS

A trunk radio system is a system whereby all available radio channels are placed in one single pool. When for example person A requires to transmit, a channel is automatically picked from the pool and used for person A’s transmission. Once the transmission is completed, the channel that person A was using will be placed back into the pool for others to use.

This system is highly beneficial as radio channels are limited by nature as for example, if all radio channels are taken up, we can’t physically or manually ‘create’ new channels. By using a trunk radio system, it’s more efficient in a sense there is a higher chance a user will get access to an available channel when required.

Home Automation System -  HAS:

Home automation is nothing but the mechanical management and administration of intelligent electronic appliances in a house. Sequencing pre-programmed smart devices to meet the unique needs of the residents is what a home automation system does.

In a home automation solution, devices can trigger each other without any human intervention. Furthermore, it allows users to schedule automated processes like switching the lights, controlling the temperature, calibrating the entertainment system, and more. What is home automation? It is an integrated system that makes life more convenient and helps in saving a variety of costs.

Fence Intrusion Detection System – FIDS

A fence intrusion detection system or FIDS for short is a security system whereby the key purpose of this system is to be able to detect any breaches that occur on any perimeter fences.

There are multiple sensors installed on different parts of the fence so whenever an intrusion is detected in a certain fenced area, if there is a CCTV nearby, the security personnel would be able to angle the CCTV to view the intrusion if possible. If necessary, a physical check on the fence is needed as well to ensure the security and integrity of the perimeter.

Building Management System - BMS:

Building Management Systems (BMS) that integrate and control various building functions. There are multiple sensors installed on different parts of the utility system. BMS Engineer control all utility system from single room. Building Management System also known as IBMS and BAS in Americas and the European countries.

IO Points are further categorized into analogue & digital, with suitable field devices. & sophisticated third party devices fixed in a building ranging from grounding an elevator to monitoring the water level of a sump to monitoring & controlling the properties of HVAC (Heating, Ventilation & Air Conditioning) equipment that is the Temperature, RH, Pressure.

Water Leak Detection (WLD) system:

Early Water Detection is essential in a lot of businesses, for example, data centers, industrial sites, offices, hotels, residential buildings, and more. With the right detection of water and early alert, costly water damage can be avoided. HW group offers several products that provide ideal solutions for Water Leak Detection (WLD) that are developed to protect your facility against any water damage that might threaten you.

Water Leak Detection uses a sensing cable that detects water along the entire cable length and a WLD device (WLD2 / NB-WLD / ...) that can communicate an alarm in case of water occurrence (a few drops anywhere on the cable is enough).

Master Clock System – MCS:

A master clock system is an interconnected system of clocks whereby slave clocks would take reference of time from a reference clock, also known as a master clock. These slave clocks would synchronize their time with the master clock. In this way, the time across both the master and slave clocks would be the same.

The use of master clock systems can be used in a variety of industries such as for the IT sector and military or anywhere that requires an extremely high degree of time accuracy.

Rodent Repellent System:

Rodent repellent is a device unit that emits ultrasonic sound waves to create an acoustically hostile environment that repels rodents. This helps to keep your Data Center free form rodents. Frequency of sound will induce rodents to move away from Data Center premises. As per research by University of Nebraska, Rodent Repellent is a proven device. Rodents under test could either leave the buildings or move to alternate non-ultrasonically treated areas.

As Data Center is the important business premises, we need to protect it from many risks.

Exit Stopper Door Alarms:

The highly effective Exit Stopper can serve as an inexpensive security device and help stop theft by alerting you to any unauthorized exits or entries through emergency exit doors. Standalone fire exit stopper alarm with one relay for integration with fire alarm system.

Professional Display & Signage

Professional display screens are high-quality, commercial-grade screens specifically designed for continuous use in business settings. Unlike consumer-grade TVs, they’re engineered to operate reliably for extended hours, often supporting 24/7 use without compromising on display quality or durability. Professional displays come with advanced features like remote content management, high brightness, and enhanced connectivity options, making them ideal for business environments.

ELV digital signage systems can provide real-time information, such as maps, directions, and event schedules, for tourists. This can improve convenience and enhance the overall experience by providing accurate and up-to-date information.

GRMS System:

Operates light management (on, off, or dimmer), automatic curtain openings (including blinds and rolling shutters), HVAC, TVs, and “do not disturb” or “make up room,” alerts based on the presence or absence of the guest in the room.

Mobile Phone and Wireless Distribution: 

Seamless connectivity, accessibility, and communication throughout a building.

Vehicle Tracking System

The GPS based Vehicle Tracking System comprises of an in-vehicle tracking system that consists of a GPS receiver unit, CDMA/GSM Modem, on-device Data Storage unit, other peripherals, and a web-based application. Through this system, the users will have the facility to monitor the movement and gather entire information of any vehicle.

IoT:

The IoT provides the connectivity that enables real-time monitoring and control of building systems, both on-site and remotely. With IoT-enabled BMS, building operators can monitor and control systems from anywhere, anytime, through a single user interface. This allows for greater efficiency, cost savings, and improved building performance.

In smart infrastructure, ELV systems, BMS, and IoT play a similar role in optimizing and monitoring the performance of critical infrastructure systems, such as energy grids, water supply networks, and transportation systems. These systems can be monitored and controlled in real-time to improve efficiency, reduce costs, and ensure reliability.

Role of IOT in improving ELV systems

The Internet of Things (IoT) can significantly improve ELV (Extra-Low Voltage) systems. IoT technology can connect and monitor ELV systems, providing real-time information, control, and automation capabilities.

Here are some ways in which IoT can improve ELV systems:

1.   Monitoring and Control: IoT devices, such as sensors and actuators, can control ELV systems, such as lighting, HVAC, and security systems. This can provide real-time information and allow for remote control of these systems, improving efficiency, comfort, and security.

2.   Predictive Maintenance: IoT technology can collect data from ELV systems and analyze it to predict when maintenance is needed. This can improve system reliability and reduce downtime, increasing efficiency and reducing costs.

3.   Energy Management: IoT technology can monitor and control energy consumption in ELV systems, reducing waste and improving energy efficiency. This can contribute to sustainability and reduce costs.

4.   Integration: IoT technology can integrate ELV systems with other building management systems, such as BMS (Building Management Systems), providing a more comprehensive and integrated solution.

5.   Real-time Analytics: IoT technology can collect and analyze real-time data from ELV systems, providing valuable insights into system performance and usage patterns. This can help to optimize system operation and improve decision-making.

Role of AI in ELV systems

Artificial Intelligence (AI) is playing an increasing role in ELV systems, including lighting control, building automation, audio and video systems, security systems, and more. AI can be used to improve the performance, efficiency, and intelligence of ELV systems in several ways:

1.   Predictive Maintenance: AI can analyze data from ELV systems to predict when maintenance or repairs will be required. This can reduce downtime and improve the overall reliability of the systems.

2.   Energy Efficiency: AI can optimize energy consumption in ELV systems, such as lighting control systems. For example, AI algorithms can analyze occupancy patterns and adjust lighting levels accordingly to reduce energy consumption.

3.   Real-Time Monitoring: AI can monitor ELV systems in real-time, providing early warning of potential issues and allowing for proactive maintenance and repairs.

4.   Automated Decision-Making: AI can automate decision-making processes in ELV systems, such as lighting or HVAC control. For example, AI algorithms can automatically analyze weather data and occupancy patterns to adjust heating and cooling levels.

5.   Improved User Experience: AI can improve the user experience of ELV systems, such as voice-controlled lighting control systems or personalized audio and video systems.

Role of cyber security for ELV systems

Cybersecurity is critical for ELV systems due to the sensitive nature of the systems and the potential consequences of a security breach. ELV systems are integrated into building management systems and often control essential functions, such as lighting, heating, ventilation, air conditioning, and security systems. Therefore, a breach of an ELV system can result in unauthorized access, loss of sensitive information, or disruption of critical building functions.

Here are some ways in which cyber security is essential for ELV systems:

1.   Protecting Sensitive Information: ELV systems often contain sensitive information, such as building plans, access codes, and security camera footage. Cybersecurity measures are necessary to protect this information from unauthorized access or theft.

2.   Preventing Unauthorized Access: ELV systems can be vulnerable to hacking or unauthorized access, allowing attackers to control or disrupt building functions. Cybersecurity measures, such as firewalls, access control systems, and encryption, are necessary to prevent unauthorized access.

3.   Maintaining Building Functionality: A breach of an ELV system can result in the disruption of critical building functions, such as heating, cooling, lighting, and security systems. Cybersecurity measures are necessary to maintain the functionality of these systems and protect against disruptions.

4.   Compliance with Regulations: Many countries have regulations and standards for cybersecurity in buildings, such as the European Union's General Data Protection Regulation (GDPR) and the United States Federal Information Processing Standard (FIPS). ELV systems must comply with these regulations to protect sensitive information and the security of building functions.

Conclusion

Now that you understand more about ELV systems and their various components, SSA INTEGRATE provides ELV system integration services for the telecommunications, security, surveillance and oil & gas industries.

We have a team of highly experienced engineers and technicians who would be able to assist you in any challenging system integration issues.

Our service is that we can design, supply and commissioned full ELV integrated systems, complete with detailed testing and following the actual site condition to ensure full functionality before handing over the project. Also we provide Information Security Management System audit as per ISO/IEC 27001: 2022.

Due to our experience in installing explosion proof systems, we are well versed in working and installing ELV systems in hazardous environments.

Privileged Access Management

Privileged Access Management 

Privileged access management (PAM) is defined as the provisioning of tools that help organizations manage and secure accounts that have access to critical data and operations. Any compromise in these ‘privileged’ accounts can lead to financial losses and reputational damage for the organization.

Every organization’s infrastructure is built with multiple levels of deployments, data stores, applications, and third-party services. Some of these components are critical for operations, while some may be as mundane as email.

But each of these is accessed by user accounts, which are of two types:

Human users: They are typically employee accounts, encompassing all departments, including HR, DevOps, and network administrators. 

Automated non-human users: These are third-party applications and services that require an account to integrate with the organization’s systems.

‘Privilege’ is defined as the authority that an account has to modify any part of the company’s technology architecture, starting from individual devices to the office network. This privilege allows the bypassing of security restraints that are normally applied across all accounts.

A standard account is a norm among employees, with the least privileges attached to it. These accounts are used to access and operate limited resources such as internet browsing, emails, and office suites. A privileged account possesses more capabilities than a standard account. This elevated access is gained using privileged credentials.

Despite the numerous headline-making incidents in recent years, cybercrime continues to rise with reported data breaches increasing by 75% over the past two years. For those that suffer a breach, the repercussions can be costly:

increased public scrutiny, costly fines, decreased customer loyalty and reduced revenues. It is no wonder that cybercrime has risen towards the top of the concern list for many organisations and the customers with whom they do business.

You’ve heard many of the stories. Equifax, Uber, Facebook, My Heritage, Under Armor, and Marriott. Personal data from millions of their customers was stolen. Even though the number of breaches went down in the first half of 2018, the number of records stolen increased by 133 percent to almost 4,5 billion records

worldwide. Unfortunately things are only likely to get worse. According to a 2018 study from Juniper Research, an estimated 33 billion records will be stolen in 2023 – this represents a 275 percent increase from the 12 billion records

that are estimated to have been stolen in 2018.

Are you ready for more bad news? Thanks to the demands of the application economy, the threat landscape has expanded and protecting against these threats has only gotten more challenging.

Victims of the future

Digital transformation is a necessity for organisations to not only survive, but thrive in the application economy. But these transformations are creating an expanding set of new attack surfaces that must be defended, in addition to the

existing infrastructure that you’ve been protecting for years. These new points of vulnerability include:

DevOps adoption: In more sophisticated IT shops, continuous delivery/ continuous testing practices have introduced automated processes that see no human intervention at all. In many cases, these scripts or tools are often using hard-coded administrative credentials that are ripe for theft and misuse.

Hybrid environments: As your IT environment has evolved to include

software-defined data centres and networks, and expanded outside of your four walls to incorporate public cloud resources and software-as-a-service (SaaS) applications, the traditional way of approaching administration and management quickly falls apart – mainly because it fails to protect new attack surfaces like management consoles and APIs.

Internet of Things: Smart devices are proliferating in our lives, from phones to watches, from refrigerators and cars to medical implants and industrial machinery. And because these devices have connectivity, not only can they be hacked, but they are already being compromised where security is inadequate or non-existent.

Third-party access: Outsourcing development or IT operations has become the

norm. In addition, many companies are sharing information with partners. However, many of these third-party employees are being granted ‘concentrated power’ via administrative access. Who is watching how they are using or potentially misusing that access?

Take hold of the flame

Stealing and exploiting privileged accounts is a critical success factor for types of attacks. This is not surprising when one considers that privileged identities have access to the most sensitive resources and data in your environment; they literally hold the keys to the kingdom.

Thankfully, there is a positive angle you can take on this fact. If privileged accounts are the common thread amongst the innumerable attack types and vulnerability points, then these accounts – and the credentials associated with them – are exactly where you should focus your protection efforts.

For many, focusing on ‘privileged users’ is difficult because its population can be so diverse. Privileged accounts and access are not just granted to employees with direct, hands-on responsibility for system administration, but also to contractors and business partners. You may even have privileged unknowns who are securing ‘shadow IT’ resources without your knowledge. And finally, in many cases, privileged accounts aren’t even people – they may be applications or configuration files empowered by hard-coded administrative credentials.

This begs the question, if you can’t even get a clear tally of who represents your privileged user population, how can you hope to protect these accounts?

By securing those accounts at each stop along the breach kill chain.

Breaking the chains

What is a kill chain? It’s the series of steps an attacker typically follows when carrying out a breach. While the chain can comprise numerous steps, there are four key ones in which privileged credentials represent the cornerstone of an attack. These include:

1. Gain access and expand: To access the network, insiders might exploit the credentials they already have, while outsiders will exploit a vulnerability in the system to steal the necessary credentials.

2. Elevate privileges: Once inside, attackers will often try to elevate their privileges, so they can issue commands and gain access to whatever resources they’re after.

3. Investigate and move laterally: Attackers rarely land in the exact spot where the data they’re seeking is located, so they’ll investigate and move around in the network to get closer to their ultimate goal.

4. Wreak havoc: Once they have the credentials they need and have found exactly what they’re looking for, the attackers are free to wreak havoc (e.g. theft, business disruption, etc.).

If you can prevent an unauthorised user – insider or outsider – from gaining access to the system in the first place, you can stop an attack before it even starts.

To prevent unauthorised access, you must:

• Store all privileged credentials in an encrypted vault and rotate these credentials on a periodic basis.

• Authenticate all users, applications, and services before granting access to any

privileged credential.

• Employ automatic login and single sign-on so users never know the privileged credential.

Limiting privilege escalation

In many networks, it’s common for users to have access to more resources than they actually need – which means attackers can cause maximum damage quickly and even benign users can cause problems inadvertently. This is why granular access controls are so important.

To limit privilege escalation, you must:

• Adopt a ‘zero trust’ policy that only grants access to the systems people need for work.

• Implement filters and white/black lists to enable fine-grained access controls.

• Proactively shut down attempts to move laterally between unauthorised systems.

Monitoring privileged activity

Whether it’s a trusted insider who wandered into the wrong area or an attacker with malicious intent, there’s a very good chance that at some point users will gain access they shouldn’t have.

The challenge, then, is to improve visibility and forensics around user activity within sensitive systems. To deter violations at this late stage of the kill chain, you must:

• Ensure that all privileged access and activity is attributed to a specific user.

• Monitor all privileged activity to proactively detect unusual behaviour and trigger automatic mitigations.

• Record all user sessions so that all privileged activities can be played back in DVR-like fashion.

• Review and certify privileged access on a periodic basis to ensure that it is still required.

Biometric security key for phishing-resistant MFA

Biometric security key for phishing-resistant MFA 

Biometric security keys, like those compliant with FIDO2, offer phishing-resistant multi-factor authentication (MFA) by using fingerprint or facial recognition alongside a secure element on the key. This method combines the strength of hardware-based security keys with the convenience of biometrics, making it difficult for attackers to gain unauthorized access even if they obtain a user's password. 

How it works:

·        FIDO2 Compliance:

These keys adhere to the FIDO2 standard, which is a set of protocols designed for strong, phishing-resistant authentication. 

·        Biometric Authentication:

The key incorporates a fingerprint sensor or other biometric scanner. 

·        Secure Element:

The key contains a secure element to store cryptographic keys and biometric data, preventing compromise. 

·        Phishing Resistance:

Even if a user is tricked into entering their password on a fake website, the attacker would still need the physical security key and the corresponding biometric information to authenticate. 

Token has announced the launch of Token BioKey, a new line of FIDO-compliant security keys that provide enterprises with phishing-resistant, passwordless multifactor authentication (MFA). Built with on-device fingerprint sensors and secure elements, Token BioKey delivers biometric authentication in a compact, field-upgradable form factor and complements Token’s wearable biometric smart ring.

The Token BioKey series includes two models:

• Token BioKey: USB-only connectivity.

• Token BioKey Plus: USB + Bluetooth + NFC + USB-rechargable.

Both models feature a capacitive fingerprint sensor for on-device biometric verification and an EAL5+ certified secure element for safe storage and use of FIDO credentials. The Plus model features a battery that powers radio functions when the device is not connected to the user's device.

“Token BioKey is designed to meet the evolving security needs of modern enterprises,” said Rob Osterwise, VP R&D, CTO of Token. “By combining biometric authentication with flexible connectivity options and centralised management, we are providing organisations with a scalable solution to combat phishing and other cyberthreats.”

Key features

• Phishing-resistant MFA: Mitigates risks associated with phishing, man-in-the-middle attacks, and other vulnerabilities of legacy MFA solutions.

• Biometric security: Ensures that only the registered user can use the key, even if it is lost or stolen.

• Field upgradable: Allows for firmware updates to address emerging threats and maintain cutting-edge security.

• Centralised management: The Token Authenticator Console enables administrators to manage hardware assignments, customise security settings, and handle provisioning and deprovisioning across the organisation.

• Seamless integration: Compatible with major IAM and SSO solutions, including Microsoft, Cisco Duo, Okta, Google, and Ping.

Benefits of Biometric Security Keys for MFA:

·        Enhanced Security:

Biometrics add an extra layer of security, making it much harder for attackers to impersonate a user. 

·        Phishing Resistance:

Hardware security keys are inherently resistant to phishing attacks because they are not vulnerable to the same threats as passwords or one-time codes sent via SMS or email. 

·        Convenience:

Biometric authentication can be more convenient than entering long passwords or waiting for SMS codes. 

·        Passwordless Authentication:

In some cases, biometric security keys can enable passwordless logins, further simplifying the authentication process. 

·        Compliance:

Organizations are increasingly adopting phishing-resistant MFA solutions to meet security standards and regulations. 

 

Barcode Access Control System for Businesses

Barcode Access Control System for Businesses 

In the ever-evolving landscape of security technology, access control systems have become increasingly sophisticated. With so many options, it can be difficult to know which is best and how to choose the right system for your company. A barcode access control system is one way you can control who physically enters your facilities. It’s a relatively inexpensive and flexible security option.

Chances are, you’ve encountered barcode access control systems in the past, be it at a place of work or in a public place. They simplify access control for users and administrators alike.

What is an Access Control System? 

An access control system regulates who has access to your property. Via various methods, the system grants access to authorized people and denies access to unauthorized people.

Access control systems can be simple, requiring people to swipe a card or punch in a code. Most access control brands, such as Openpath and Vanderbilt, can also be intricate, requiring cards to be swiped in a certain order or using biometric information to grant or deny access. Barcode systems are common and intuitive. 

What is a Barcode Access Control System?  

A barcode access control system is a relatively simple system that’s easy to implement on a wide scale. It requires employees or authorized personnel to present a barcode to gain access to the facility.

In addition to scanning barcodes, a similar form of access control scans QR codes as well. These both work in the same way; the person attempting to gain access swipes their code or displays it in front of a reader to gain access. 

How Does a Barcode Access Control System Work? 

Barcode access control works through a simple process. Barcode readers scan barcodes, which can be on paper, phones, devices, key tags, id cards, or badges, for example.

Access can be granted via automatic or manual readers. With automatic readers, you’ll need to install scanners at each entrance where you want to control access. Many companies and businesses that require patrons to gain access use automatic readers so employees or patrons can access the facility at any time. For example, an employee can swipe into work in the morning, and they can also swipe in at 9 pm when they realize they left their wallet at their desk. Similarly, patrons at a 24/7 gym can show up to work out at 3 am without requiring an employee to let them in.

With manual readers, you’ll need to station an employee with a handheld scanner at each entrance where you want to control access. This is typically used in workplaces where security is more important. You might also see manual readers with stationed employees at events that require barcode access, such as a concert or sporting event. 

When somebody attempts to gain access, they’ll swipe their barcode in the scanner. The scanner is connected to the access control system and sends the information from the swipe to the system. 

The access controls system records the unique ID that attempted access along with the date and time. It also grants or denies access. If access is granted, the system will unlock the door or complete whatever action is needed for the person to gain entry.

Types of Barcodes Used:

• Linear Barcodes: Traditional barcodes with parallel lines, like UPC and EAN. 
• 2D Barcodes (QR Codes): Can store more data and are often used with smartphones. 

What Are the Pros and Cons of a Barcode Access Control System? 

Barcode access control systems are relatively straightforward, and they’re used in many industries. Many office buildings use them for employees, and you may have also encountered them in public places, such as a gym, public transportation, or on a college campus.

Many industries use this type of system, but it isn’t right for everybody. Understanding the pros and cons can help you determine if you should choose a barcode access control system for your business.

Pros of Barcode Access Control 

Compared to other types of access control, a barcode access control system is relatively inexpensive. It’s also easy to create a new barcode for a new employee or for temporary access. In fact, you can regularly create new barcodes for temporary employees or visitors, and you can also specify when certain people will be granted access.

Barcode systems provide an opportunity to keep tabs on traffic. Because they log who is accessing the area and when, you can see the busy or slow times. You can also keep track of any access attempts that were denied. The system keeps tabs on when each person was granted access as well, which is helpful if you need to investigate an incident. It can help you narrow down who was likely in the building at the time the incident occurred.

Barcodes can also be duplicated and are non-proprietary. This makes it simple to customize the system, create new codes, and keep the access control system running smoothly. A common way to use barcode access control is for entrance to concerts or special events. It’s easy to create a one-time barcode for somebody to print or display on their phone. All they need to do is scan their code to gain entry to the event. 

Cons of Barcode Access Control 

Barcode access control isn’t the most secure form of access control. A biometric reader, for example, is better at ensuring the person attempting to gain access is who they say they are. Allowing 24/7 access to anybody with a barcode can present a security risk. 

Additionally, barcode access control requires people to swipe their card or place it in front of an optical reader. This isn’t a huge deal for most people, but it can be more cumbersome than simply getting near the reader with a prox card. If employees are often entering the building carrying a lot of things, this can be frustrating for them.

Courtsy: Alicia Betz for supportive information.

PCI- SSC in Access & Video Surveillance

PCI- SSC in Access & Video Surveillance 

The Payment Card Industry Security Standards Council (PCI SSC) does not mandate specific video surveillance requirements, but it does have general physical security requirements that can be fulfilled through video surveillance or other methods. PCI DSS Requirement 9.1.1 specifically states that organizations must monitor physical access to sensitive areas using either video cameras or access control mechanisms. 

In this era of widespread digital transactions, we cannot overstate the importance of PCI-SSC. PCI-SSC serves as a guiding beacon, directing organizations toward the highest levels of security when handling payment card information. By prioritizing and adopting PCI-SSC standards, organizations can defend themselves against online attacks and enhance the overall integrity and reliability of the global payment ecosystem. The dedication of PCI-SSC to protecting the cornerstone of contemporary commerce remains unwavering, even as technological improvements continue.

What is PCI-SSC?

The Payment Card Industry Security Standards Council is a global organization founded in 2006 by credit card companies such as Visa, MasterCard, American Express, Discover, and JCB. Its mission is to develop and improve security standards for payment card transactions. The PCI-SSC is crucial in bringing stakeholders from the payments industry to create and promote adopting data security standards and resources. It is responsible for crafting and updating the PCI Security Standards, guidelines that dictate how organizations must protect cardholder data.

Compliance with PCI-DSS is mandatory for all entities that handle credit cards, encompassing those that accept, transmit, or store such information. To assist organizations in meeting PCI-DSS requirements, the PCI-SSC offers a range of resources, including training programs, assessment tools, and best practices. The significance of PCI-SSC lies in its dedication to safeguarding cardholder data from fraud and theft, aiding organizations in reducing the risk of data breaches, and ensuring the security of their customers.

Role of PCI-SSC

1. Develop and Maintain the PCI-DSS:

The PCI-SSC actively develops and updates the PCI Data Security Standard (PCI-DSS), outlining guidelines for safeguarding cardholder data. It ensures the PCI-DSS remains current and addresses the latest security threats. The PCI-SSC actively maintains and evolves the standards to meet the dynamic challenges of securing payment card information.

2. Promote Awareness of PCI-DSS Compliance:

The PCI-SSC actively raises awareness about PCI-DSS compliance through its website, social media, and public relations campaigns. Collaborating with industry organizations, it strives to promote understanding and adherence to PCI-DSS across various channels. The PCI-SSC engages in widespread efforts to highlight and encourage compliance with PCI-DSS standards.

3. Assess Organizations for PCI-DSS Compliance:

The PCI-SSC does not directly assess organizations for PCI-DSS compliance. Instead, it approves and supervises Qualified Security Assessors (QSAs) who conduct PCI-DSS assessments. In essence, the PCI-SSC delegates the assessment process to qualified professionals to ensure compliance with PCI-DSS standards.

4. Educate and Train Organizations on the PCI-DSS:

The PCI-SSC provides diverse training programs and resources to educate organizations on complying with the PCI-DSS. These offerings encompass a broad spectrum of subjects, including security requirements, assessment procedures, and best practices, aiming to equip organizations with comprehensive knowledge and skills. The PCI-SSC actively fosters education and training to implement PCI-DSS guidelines effectively.

Importance of PCI-SSC

1. Protection Against Cyber Threats:

In the digital age, there’s been a concerning rise in cyber threats like data breaches and identity theft. PCI-SSC serves as a safeguard by establishing and maintaining security standards that businesses must follow, guaranteeing the protection of sensitive payment information from potential threats.

2. The PCI-DSS is Up-to-Date:

The PCI-SSC actively updates the PCI-DSS to address the latest security threats, ensuring that organizations employ the most effective security measures for cardholder data protection. This ongoing process reflects the commitment to staying ahead of evolving risks in the digital landscape. In essence, organizations benefit from a current and robust framework to safeguard sensitive information.

3. Facilitating PCI-DSS Compliance:

The PCI-SSC provides diverse resources, such as training programs, assessment tools, and best practices, to assist organizations in complying with the PCI-DSS. These offerings simplify the compliance process for organizations of all sizes, ensuring accessibility and support in implementing PCI-DSS guidelines.

4. Comprehensive Security Framework:

PCI-SSC establishes a comprehensive framework encompassing payment card security aspects like network security, encryption, access controls, and regular testing. This all-encompassing strategy ensures vulnerabilities are tackled from various perspectives, establishing a solid defense mechanism against potential breaches.

PCI DSS and Physical Security:

PCI DSS (Payment Card Industry Data Security Standard) includes requirements for protecting physical access to areas where cardholder data is stored, processed, or transmitted.

The PCI standard requires, “either video cameras or access control mechanisms (or both) to monitor individual physical access to sensitive areas,” which allows some flexibility. “Sensitive areas” include:

“data centers, server rooms, back-office rooms at retail locations, and any area that concentrates or aggregates cardholder storage, processing, or transmission. . . This excludes public-facing areas where only point-of-sale terminals are present, such as the cashier areas in a retail store ”

Bottom line: If your PCI compliance solution lacks relevant access control, then you will need security cameras monitoring individual physical access to your organization’s sensitive areas.

Requirement 9.1.1:

This requirement focuses on monitoring physical access to sensitive areas, which include data centers, server rooms, and other locations where cardholder data is handled.

Video Surveillance as a Solution:

Organizations can use video cameras or other access control mechanisms (like keycard systems) to meet this requirement.

Not a Requirement for Footage Retention:

Importantly, PCI DSS does not mandate a specific retention period for video surveillance footage.

Focus on Access Control:

The primary goal of these physical security measures is to prevent unauthorized access to sensitive areas, thus protecting cardholder data.

Key considerations when using security cameras for PCI compliance

Here are four additional considerations specific to security cameras in the context of PCI compliance:

1. Regularly scheduled risk assessments. A full understanding of the security camera system, business environment, and threat environment allows for any adjustments needed to maintain compliance and continuously improve processes.
2. Employee training & awareness. Educating employees about PCI compliance is essential to program success. Employees who are aware can understand how their role can impact compliance and support ongoing program success.
3. Partnering with a vendor. A vendor that understands PCI compliance using security cameras and that offers solutions can remove the burden of program management from your staff, so you can focus on your mission-critical activities. Vendors also have knowledge leadership in the field that typically yields optimal program performance and results.
4. Security cameras + access control. A hybrid solution provides the highest level of compliance and protection. Seamless integration of access control with security cameras provides a framework for full visibility and control of your security environment.

Can the video retention be motion-based?

The PCI standard does not specify whether security systems that utilize motion-based video may be used. However, 24/7 recording with time stamps provides a comprehensive, clear record of all entry and exit events in an area for access control purposes.

The advantage of motion-based recording is reduced costs for storage. The disadvantages include false positives from background motion (passing cars, blowing leaves, birds, etc.) and false negatives (cameras not activating to record incidents). 24/7 recording avoids those disadvantages, while the three-month requirement under PCI makes data storage costs manageable.

Maintaining compliance

Achieving PCI compliance is simply the beginning. Maintaining compliance requires a consistent, strategic commitment to an ongoing compliance program. The three most important elements of an effective program are:

1. Dedicate resources necessary to continuously maintain compliance. This includes commitments of people and technologies.
2. Regularly assess & test the information security environment. Implement a framework to identify whether controls are working and enact appropriate changes that support continuous improvement.
3. Mature your vulnerability management. Vulnerability scans, patching, configuration management, passwords, and permissions reviews are part of an ongoing program to understand and respond to evolving vulnerabilities.

Ref:

1.      https://kirkpatrickprice.com/video/pci-requirement-9-1-1-use-either-video-cameras-access-control-mechanisms-monitor-individual-physical-access-sensitive-areas/

2.      https://www.getscw.com/knowledge-base/pci-compliance-doesn-t-need-90-days-of-footage#:~:text=PCI%20DSS%20has%20no%20specific,no%20requirements%20for%20footage%20retention.

3.      https://www.pcisecuritystandards.org/